SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PowerChute Vendors:   American Power Conversion Corp.
PowerChute Network Shutdown Uses a Non-Secure Web Interface
SecurityTracker Alert ID:  1015250
SecurityTracker URL:  http://securitytracker.com/id/1015250
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 22 2005
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information
Vendor Confirmed:  Yes  Exploit Included:  Yes  

Description:   A vulnerability was reported in PowerChute Network Shutdown. The product uses a non-secure web interface.

The web interface only supports the HTTP protocol, which is not secure. A remote user with the ability to monitor the network between the administrator and the web service can obtain the administrative password and can obtain all transmitted data.

The web interface also permits an unlimited number of login attempts without enforcing a lockout period and without logging the attempts.

All versions of PowerChute Network Shutdown are affected.

The vendor credits James Gaffney with reporting this vulnerability.

Impact:   A remote user with the ability to monitor the network may be able to obtain the administrative password by monitoring plain text network communications.
Solution:   No solution was available at the time of this entry. However, the vendor has provided the following workarounds [quoted]:

1. Only log into PowerChute Network Shutdown from
http://localhost:3052.

Use a browser on the same server that PowerChute Network Shutdown is
running to access the web interface. This prevents any traffic from
being transmitted onto the network and eliminates the potential for
password snooping.

2. Enable a local server firewall rule to block any remote access to
TCP port 3052.

This can be used in conjunction with number one to prevent the
possibility of any remote user accessing PowerChute Network Shutdown.

3. Disable the web interface.

Disabling the Web Interface prevents any user from accessing the web
interface from anywhere. However, since the web interface of
PowerChute Network Shutdown is the only way to view status and logs
and make configuration changes, APC does not recommend this option.
Search APC's Knowledge Base for this advisory to view instructions
on how to disable the PowerChute Network Shutdown web interface.

Vendor URL:  nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=7330 (Links to External Site)
Cause:   Access control error

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC